Fix: Addressed out-of-bands read from a buffer in udp_rx_dequeue function #1320
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
soopel
commented
Nov 14, 2025
soopel
commented
- Guarded udp_rx_dequeue against truncated mbufs by comparing rte_pktmbuf_pkt_len(pkt) with sizeof(struct mt_udp_hdr) and bailing with EBADMSG if the headers aren’t fully present.
- Recomputed the payload pointer via rte_pktmbuf_mtod_offset and validated the UDP payload length against both the UDP header value and the actual bytes available in the mbuf before any rte_memcpy, preventing the out-of-bounds read.
- Logged richer diagnostics (using signed widths) and set errno when malformed packets are detected so callers receive a clear failure instead of silent drops.
soopel
requested review from
DawidWesierski4,
Falron98 and
Sakoram
as code owners
There was a problem hiding this comment.
Pull Request Overview
This PR fixes a critical security vulnerability in the UDP receive path by adding comprehensive validation to prevent out-of-bounds buffer reads. The changes guard against malformed or truncated packets that could cause memory safety issues.
Key changes:
- Added packet length validation before header access to ensure headers are fully present
- Implemented payload bounds checking against both UDP header length and actual mbuf capacity
- Enhanced error reporting with detailed diagnostics and proper errno setting
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…eader/payload bounds checks, switching to a safe payload pointer, and rebuilding to ensure everything still compiles—here’s the rundown. Actions taken Guarded udp_rx_dequeue against truncated mbufs by comparing rte_pktmbuf_pkt_len(pkt) with sizeof(struct mt_udp_hdr) and bailing with EBADMSG if the headers aren’t fully present. Recomputed the payload pointer via rte_pktmbuf_mtod_offset and validated the UDP payload length against both the UDP header value and the actual bytes available in the mbuf before any rte_memcpy, preventing the out-of-bounds read. Logged richer diagnostics (using signed widths) and set errno when malformed packets are detected so callers receive a clear failure instead of silent drops.
soopel
force-pushed
the
mswirydc_coverity_551169
branch
from
78959ec to
0222502
Compare
Co-authored-by: Copilot <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.